Staff Engineer, Cloud Security

• Toast creates technology to help restaurants and local businesses succeed in a digital world, helping business owners operate, increase sales, engage customers, and keep employees happy.
• The Product & Platform Security team at Toast protects the cloud infrastructure and services that restaurants depend on every day.
• We are looking for a Staff Engineer, Cloud Security to expand the scope and coverage of our cloud security capabilities.
• You will join an existing cloud security team and take a role in setting direction for how Toast secures its cloud environments.
• This is a hands-on role with technical leadership

responsibilities

you will build and operate security tooling and controls yourself, while also shaping strategy, mentoring teammates, and influencing the roadmaps of engineering teams across R&D.

Our footprint is primarily AWS. You will work closely with Platform and Infrastructure teams in R&D, and with Defense & Response and other Security Engineering teams within Trust & Security.

A day in the life

(Responsibilities)

• Own and operate our Cloud-Native Application Protection Platform (CNAPP), including tuning, coverage, integrations, and turning findings into prioritized, actionable work for engineering teams.
• Lead cloud security posture management (CSPM) across our AWS organization and accounts, defining standards and measuring adherence over time.
• Drive identity and access management improvements, including least privilege, role and permission design, and reducing standing access.
• Secure our container environments, from image and workload security to cluster configuration and runtime protection.
• Build guardrails and secure defaults into infrastructure as code and deployment pipelines, so that teams get secure configurations by default rather than through review.
• Perform secure architecture reviews and threat modeling for new and existing cloud services and platform capabilities.
• Partner with our SOC on cloud detection coverage, logging, and investigation readiness.
• Run and improve cloud vulnerability and misconfiguration remediation programs, working with engineering owners to drive risk down.
• Participate in security incident response, including on-call coverage, and lead the cloud side of investigations and follow-up work.
• Set the multi-year direction for cloud security at Toast, and mentor and uplevel other engineers on the team.
• Build trusted relationships with Platform, Infrastructure, and product engineering leaders, and influence their priorities through data and clear risk communication.

What you'll need to thrive (Requirements)

• 8+ years of experience in security engineering, infrastructure, or software engineering, with significant time focused on cloud security.
• Deep, hands-on experience securing AWS environments at scale, including IAM, Organizations, networking, logging, and core security services.
• Experience deploying and operating cloud security tooling, such as CNAPP or CSPM platforms (for example Orca, Wiz, or Upwind).
• Experience with container and Kubernetes security (for example EKS).
• Experience performing threat modeling and security architecture reviews for cloud services and platform capabilities.
• Experience responding to security incidents in cloud environments.
• Proficiency with infrastructure as code (for example Terraform) and in at least one programming language used for automation (for example Python or Go).
• A track record of leading cross-team technical initiatives and influencing engineering teams without direct authority.
• History of setting technical direction for a security domain, including a multi-year roadmap and the decisions behind it
• Clear written and verbal communication, including explaining risk and tradeoffs to engineers and leaders.

What will help you stand out (Nonessentials/Nice to Haves)

• Experience with GCP, Azure, or other cloud platforms.
• Experience with cloud detection engineering or incident response in cloud environments.
• Familiarity with compliance frameworks relevant to payments and SaaS, such as PCI DSS or SOC

2.

• Relevant certifications, such as AWS Certified Security Specialty or CCSP.
• Experience mentoring engineers or growing a security function.

AI at Toast

• At Toast, one of our company values is that we're hungry to build and learn.
• We believe learning new AI tools empowers us to build for our customers faster, more independently, and with higher quality.
• We provide these tools across all disciplines, from Engineering and Product to Sales and Support, and are inspired by how our Toasters are already driving real value with them.
• The people who thrive here are those who embrace changes that let us build more for our customers; it's a core part of our culture.

Our Total Rewards Philosophy

• We strive to provide competitive compensation and benefits programs that help to attract, retain, and motivate the best and brightest people in our industry.
• Our total rewards package goes beyond great earnings potential and provides the means to a healthy lifestyle with the flexibility to meet Toasters' changing needs.
• Learn more about our benefits at https://careers.toasttab.com/toast-benefits .
• The base salary range for this role is listed below.
• The starting salary will be determined based on skills, experience, and geographic location.
• In addition to base salary, our total rewards components include cash compensation (overtime, bonus/commissions if eligible), equity, and benefits.
• You can learn more about how we align pay with local labor markets in our Geographic Pay Zone Philosophy .

Zone A

$193,000 — $309,000 USD

Zone B

$168,000 — $269,000 USD

Zone C

$151,000 — $242,000 USD

• How Toast Uses AI in its Hiring Process
• Throughout the hiring process, our goal is to get to know you.
• We use AI tools to support our recruiters and interviewers with tasks like note-taking, summarization, and documentation of interviews to ensure they can be fully focused on your conversation.
• All hiring decisions are made by people.
• We ask that you complete interviews and assessments on your own, without real-time AI tools, recording, or transcription bots, unless we tell you otherwise in advance.

Our Approach to Hybrid Working

• We embrace a hybrid work model that fosters in-person collaboration while valuing individual needs.
• Our goal is to build a strong culture of connection as we work together to empower the hospitality community, regardless of location.
• Please visit the Locations page on our career site to learn more about our in-office expectations by region: https://careers.toasttab.com/locations-toast
• People Are the Secret Ingredient in Our Recipe for Success
• At Toast, our employees are our secret ingredient—when they thrive, we thrive.
• The restaurant industry brings together people with a wide range of backgrounds, experiences, and perspectives, and we value that same breadth at Toast.
• We strive to build a culture grounded in authenticity, respect, and humility, where every Toaster has a real opportunity to grow, contribute, and do their best work—raising the bar in delivering exceptional experiences for our customers and each other.

Apply today!

• Toast is committed to creating an accessible and inclusive hiring process.
• As part of this commitment, we strive to provide reasonable accommodations for persons with disabilities to enable them to access the hiring process.
• If you need an accommodation to access the job application or interview process, please contact [email protected] .

------

For roles in the United States, it is unlawful in Massachusetts to require or administer a lie detector test as a condition of employment or continued employment. An employer who violates this law shall be subject to criminal penalties and civil liability.